Users and Groups in the WfSpec

When assigning UserTasks from within a WfSpec, you need to know what values to pass for the user ID and group ID. The format depends on your backend configuration.

Understanding User ID Formats

The User Tasks Bridge backend allows you to configure which JWT claim represents the user_id. This is set in your backend configuration using the user-id-claim property, which can be one of:

• SUB - The user's UUID from the IdP (default)
• EMAIL - The user's email address
• PREFERRED_USERNAME - The user's preferred username

Important: Whatever claim you configure in the backend is what you must pass when assigning tasks in your workflow.

Assigning to a Specific User

To assign a task to a specific user, pass their user ID as the second parameter and null for the group ID. The format matches your backend configuration:

Java

// If configured with EMAIL as user-id-claim:
wf.assignUserTask("approve-request", "user@example.com", null);

// If configured with SUB as user-id-claim (UUID):
wf.assignUserTask("approve-request", "a1b2c3d4-e5f6-7890-abcd-ef1234567890", null);

// If configured with PREFERRED_USERNAME as user-id-claim:
wf.assignUserTask("approve-request", "john.doe", null);

You can also use workflow variables instead of hard-coded values:

// Declare a variable to hold the user ID
WfRunVariable userId = wf.declareStr("assignee-email");

// Use the variable when assigning the task
wf.assignUserTask("approve-request", userId, null);

Go

// If configured with EMAIL as user-id-claim:
emailUser := "user@example.com"
wf.AssignUserTask("approve-request", &emailUser, nil)

// If configured with SUB as user-id-claim (UUID):
uuidUser := "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
wf.AssignUserTask("approve-request", &uuidUser, nil)

// If configured with PREFERRED_USERNAME as user-id-claim:
usernameUser := "john.doe"
wf.AssignUserTask("approve-request", &usernameUser, nil)

You can also use workflow variables:

// Declare a variable to hold the user ID
userId := wf.DeclareStr("assignee-email")

// Use the variable when assigning the task
wf.AssignUserTask("approve-request", userId, nil)

Python

# If configured with EMAIL as user-id-claim:
wf.assign_user_task("approve-request", user_id="user@example.com")

# If configured with SUB as user-id-claim (UUID):
wf.assign_user_task("approve-request", user_id="a1b2c3d4-e5f6-7890-abcd-ef1234567890")

# If configured with PREFERRED_USERNAME as user-id-claim:
wf.assign_user_task("approve-request", user_id="john.doe")

You can also use workflow variables:

# Declare a variable to hold the user ID
user_id = wf.declare_str("assignee-email")

# Use the variable when assigning the task
wf.assign_user_task("approve-request", user_id=user_id)

C#

// If configured with EMAIL as user-id-claim:
wf.AssignUserTask("approve-request", "user@example.com", null);

// If configured with SUB as user-id-claim (UUID):
wf.AssignUserTask("approve-request", "a1b2c3d4-e5f6-7890-abcd-ef1234567890", null);

// If configured with PREFERRED_USERNAME as user-id-claim:
wf.AssignUserTask("approve-request", "john.doe", null);

You can also use workflow variables:

// Declare a variable to hold the user ID
WfRunVariable userId = wf.DeclareStr("assignee-email");

// Use the variable when assigning the task
wf.AssignUserTask("approve-request", userId, null);

Assigning to a Group

To assign a task to a group, pass null for the user ID and the group name as the third parameter. Any member of the group can then claim and complete the task:

Java

// Assign to a group by name
wf.assignUserTask("approve-request", null, "approvers");

// Or using a variable
WfRunVariable groupName = wf.declareStr("approval-group");
wf.assignUserTask("approve-request", null, groupName);

Go

// Assign to a group by name
groupNameStr := "approvers"
wf.AssignUserTask("approve-request", nil, &groupNameStr)

// Or using a variable
groupName := wf.DeclareStr("approval-group")
wf.AssignUserTask("approve-request", nil, groupName)

Python

# Assign to a group by name
wf.assign_user_task("approve-request", user_group="approvers")

# Or using a variable
group_name = wf.declare_str("approval-group")
wf.assign_user_task("approve-request", user_group=group_name)

C#

// Assign to a group by name
wf.AssignUserTask("approve-request", null, "approvers");

// Or using a variable
WfRunVariable groupName = wf.DeclareStr("approval-group");
wf.AssignUserTask("approve-request", null, groupName);

Assigning to a User Within a Group

You can also assign a task to a specific user who is part of a group. This allows you to target a specific person while still indicating which group they belong to:

Java

// Assign to a specific user who is part of a group
wf.assignUserTask("approve-request", "user@example.com", "approvers");

// Using variables
WfRunVariable userId = wf.declareStr("assignee-email");
WfRunVariable groupName = wf.declareStr("user-group");
wf.assignUserTask("approve-request", userId, groupName);

Go

// Assign to a specific user who is part of a group
userEmail := "user@example.com"
groupNameStr := "approvers"
wf.AssignUserTask("approve-request", &userEmail, &groupNameStr)

// Using variables
userId := wf.DeclareStr("assignee-email")
groupName := wf.DeclareStr("user-group")
wf.AssignUserTask("approve-request", userId, groupName)

Python

# Assign to a specific user who is part of a group
wf.assign_user_task("approve-request", user_id="user@example.com", user_group="approvers")

# Using variables
user_id = wf.declare_str("assignee-email")
group_name = wf.declare_str("user-group")
wf.assign_user_task("approve-request", user_id=user_id, user_group=group_name)

C#

// Assign to a specific user who is part of a group
wf.AssignUserTask("approve-request", "user@example.com", "approvers");

// Using variables
WfRunVariable userId = wf.DeclareStr("assignee-email");
WfRunVariable groupName = wf.DeclareStr("user-group");
wf.AssignUserTask("approve-request", userId, groupName);

How to Know What Format to Use

To determine what format your backend expects:

1. Check your backend configuration file (oidc-properties.yml)
2. Look for the user-id-claim property under your IdP configuration
3. Use the corresponding format:
   • EMAIL → use email addresses (e.g., "user@example.com")
   • SUB → use UUIDs (e.g., "a1b2c3d4-e5f6-7890-abcd-ef1234567890")
   • PREFERRED_USERNAME → use usernames (e.g., "john.doe")

For more details on how users and groups work in User Tasks Bridge, see the Users & Groups concept page.